The China-nexus threat actor tracked as Fire Ant has moved beyond its established focus on VMware hypervisors, now targeting Cisco IOS XR routers, TACACS+ servers, and Linux management hosts. According to incident response firm Sygnia, the campaign is aimed at networks where these devices serve as the backbone for routing, authentication, and administrative control. The intrusion chain demonstrates a clear strategic shift: instead of merely compromising virtual infrastructure, Fire Ant is now hijacking the very systems that manage network access and security logging. By compromising TACACS+ servers, the actor can intercept and manipulate authentication credentials for network devices. Simultaneously, targeting management hosts allows for the suppression or alteration of security logs, effectively blinding defenders to ongoing malicious activity. Affected infrastructure includes Cisco IOS XR routers and associated TACACS+ servers. Linux-based management hosts used for network administration are also in scope. The actor’s tactics involve credential theft and log tampering to maintain persistence. Sygnia’s investigation underscores the sophistication of the operation, though specific indicators of compromise or detailed exploitation methods were not disclosed in the public summary. Organizations relying on these platforms should treat this as an active threat and audit their authentication and logging pipelines for anomalies. Source: The Hacker News Given that Fire Ant is now targeting network infrastructure rather than just virtualized environments, how is your organization auditing TACACS+ and management plane access for signs of similar compromise?

A newly documented Windows backdoor, named SLEEPWALKER, has been detailed by an independent malware researcher. The sample remains completely inert in memory until it receives a single, specifically crafted network packet—only then does it activate and execute commands written in its own custom bytecode language. The malware is an unsigned 64-bit Windows dynamic-link library (DLL) of 59,904 bytes. Its primary delivery method relies on DLL side-loading, a technique where a legitimate executable is tricked into loading the malicious library from an unexpected location. Once loaded, the backdoor does not phone home or listen for standard command-and-control traffic. Instead, it waits passively for a trigger packet. Upon receipt, it decodes and runs a payload built on a proprietary instruction set comprising only 23 defined opcodes. This custom architecture is likely intended to evade signature-based detection and complicate analysis efforts. File type: Unsigned 64-bit Windows DLL File size: 59,904 bytes Execution trigger: Single crafted network packet Core capability: Executes custom 23-instruction bytecode The use of a bespoke virtual machine inside the backdoor represents a significant step in evasive malware design, making static analysis and emulation considerably more difficult for defenders. Source: The Hacker News Given its passive network trigger, how is your organization monitoring for anomalous traffic patterns that don't match standard C2 behavior?

INTERPOL has announced the results of Operation Jackal IV, an eight-month coordinated effort targeting West African organized crime networks. The operation resulted in the arrest of 58 individuals and the identification of 263 additional suspects across a multinational crackdown on cyber fraud. The initiative brought together law enforcement agencies from 22 countries across six continents, reflecting the global reach of these criminal enterprises. INTERPOL specifically highlighted the threat posed by groups such as the Black Axe and similar West African syndicates, which have evolved from traditional street-level crime to sophisticated online financial fraud. While specific technical indicators were not disclosed, the operation underscores the increasing convergence of cybercrime and organized crime. These groups typically employ business email compromise (BEC), romance scams, and investment fraud to launder money and fund further illicit activities. Key aspects of the operation include: Focus on disrupting the financial infrastructure of West African crime syndicates. Coordination between international law enforcement agencies to share intelligence and track cross-border money flows. Identification of suspects for potential future prosecutions and asset seizure. The announcement did not provide specific CVE identifiers or technical malware signatures, as the focus remains on the human network behind the fraud rather than a single vulnerability. The scale of the operation suggests that law enforcement is prioritizing takedowns of entire criminal ecosystems over isolated attacks. Source: The Hacker News Does your organization actively monitor for fraud patterns commonly associated with West African criminal groups, particularly in your payment or email security layers?

Two unpatched vulnerabilities have been disclosed in Kaltura's HTML5 video player library, potentially allowing a remote, unauthenticated attacker to read arbitrary files from a server and execute code on it. The issues were reported by the CERT Coordination Center (CERT/CC) and both stem from the same unsafe deserialization flaw located in the mwEmbedLoader.php endpoint of the mwEmbed player. Because the flaws remain unpatched, there is currently no official fix available for affected deployments. CVE-2026-19913 – Allows arbitrary file read on the server. CVE-2026-19912 – Allows remote code execution via the same vulnerable deserialization path. Both vulnerabilities share a root cause, meaning a single successful exploit chain could potentially escalate from file disclosure to full code execution, depending on server configuration and the attacker's ability to reach the endpoint. The lack of a patch means administrators need to consider temporary mitigations, such as restricting access to the mwEmbedLoader.php endpoint via web application firewall rules or network-level controls, until an official update is released. The disclosure highlights a broader concern: third-party media libraries often run with elevated privileges on web servers, and a single unpatched component can undermine the entire hosting environment. It is advisable to audit any Kaltura-integrated systems for exposure to this endpoint and monitor for unusual requests targeting it. Source: The Hacker News Is your organization currently running Kaltura's mwEmbed player, and if so, what temporary controls are you putting in place while waiting for an official patch?

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released findings from two simultaneous red team engagements targeting critical infrastructure organizations. While the operators employed nearly identical tradecraft in both cases, the defensive responses—and ultimate outcomes—differed dramatically. In both assessments, the red team achieved full compromise at the domain level. However, the key divergence lay in detection: one organization identified and responded to the intrusion activity, while the other detected nothing throughout the entire operation. CISA’s report highlights how the same attack methods can yield vastly different results depending on an organization's monitoring capabilities and incident response maturity. Full domain compromise was achieved in both assessments. One organization remained entirely unaware of the red team activity. The other organization successfully detected and responded to the intrusion attempts. CISA emphasized that the tradecraft used was similar, pointing to defensive gaps rather than advanced attacker techniques as the deciding factor. The report underscores a persistent issue in critical infrastructure: even well-resourced entities may lack the visibility needed to catch determined adversaries. CISA’s findings serve as a reminder that detection and response capabilities are just as vital as preventive controls. Source: The Hacker News Does your organization have a tested incident response plan in place, and how confident are you that you would detect a similar domain-level compromise?

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog with six newly confirmed flaws, citing verified evidence of active exploitation in the wild. Among the additions is a high-severity vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway, which has been flagged as an active attack vector. The newly added entries include a remote code execution flaw tracked as CVE-2019-1068, which impacts Microsoft Windows systems. This vulnerability is part of a broader batch that spans multiple vendors and platforms, including Linux-based products and Microsoft SQL Server. Citrix NetScaler ADC and NetScaler Gateway — high-severity flaw with confirmed exploitation. Microsoft SQL Server — vulnerability included in the KEV update. Linux kernel — security bug added due to observed malicious activity. Four additional vulnerabilities were also listed, though specific identifiers for all entries were not fully detailed in the advisory. CISA's KEV catalog serves as a critical resource for federal agencies and private organizations, mandating remediation within established deadlines under Binding Operational Directive (BOD) 22-01. While the exact patch timelines vary by severity, all listed flaws require immediate attention to mitigate risk. Organizations using affected products are strongly urged to review their exposure, apply vendor-provided updates, and monitor for indicators of compromise tied to these exploits. Source: The Hacker News Does your organization track the KEV catalog closely, and how are you prioritizing the NetScaler and SQL Server patches given the active exploitation evidence?

Researchers from the University of Toronto have published details on a new Rowhammer technique that targets NVIDIA workstation GPUs equipped with GDDR6 memory. The attack, named GPUThor, is notable because it successfully bypasses ECC, the very mitigation NVIDIA recommends for defending against GPU Rowhammer. This can lead to both denial-of-service (DoS) and privilege escalation, ultimately granting an attacker a root shell on the host system. The attack works by hammering four DRAM rows simultaneously, a method that diverges from traditional Rowhammer patterns to overcome the hardware protections in place. The research team has confirmed that the exploit is effective against the NVIDIA RTX A6000 platform, highlighting a significant vulnerability in the memory subsystem of these high-end workstation cards. Key takeaways from the disclosure are: Affected hardware: NVIDIA workstation GPUs with GDDR6 memory, with the attack successfully demonstrated on the RTX A6000. Impact: Memory corruption can be leveraged for system crashes (DoS) or to achieve host-level root access. Bypassed mitigation: Standard ECC mechanisms are ineffective against the GPUThor hammering pattern. This discovery suggests that the safety margins provided by ECC on GPU memory may not be sufficient, posing a risk for environments relying on these cards for sensitive computations. Source: The Hacker News Are you currently running RTX A6000 or similar GDDR6 GPUs in your infrastructure, and how are you assessing your exposure to this type of memory corruption attack?

Arctic Wolf researchers have linked a new malware framework to the threat actor known as Dark Caracal, with medium confidence, following an intrusion detected in June 2026 at an unnamed communications organization in Venezuela. The tool, dubbed GoCaracal, is a previously undocumented, Go-based malware framework deployed during the attack. GoCaracal grants operators remote shell access and the ability to execute payloads on compromised hosts. An extended version of the framework also includes modules for browser data theft, keylogging, and remote desktop control, giving attackers broad surveillance and takeover capabilities over infected systems. One of the more distinctive features of this malware is its use of the Ethereum blockchain for command-and-control resilience. GoCaracal is designed to fetch replacement C2 addresses via an Ethereum smart contract, making it more difficult for defenders to block or takedown infrastructure using traditional domain or IP-based denylisting. Key technical details reported include: Written in Go, compiled as a single binary. Provides remote shell and arbitrary payload execution. Extended variant includes browser credential theft, keylogging, and remote desktop functions. Uses Ethereum smart contracts to resolve new C2 server addresses. Attribution to Dark Caracal is assessed as medium confidence by Arctic Wolf. Source: The Hacker News Are you seeing any novel C2 techniques like blockchain-based resolution in your threat intelligence feeds, and how are you adapting your detection to account for them?

A new phishing campaign is targeting individuals and organizations in Cambodia with an open-source remote access trojan (RAT) known as Spark RAT. The attackers are using a variety of lure themes—including government notices, public health materials, and real estate content—to appeal to a broad range of potential victims. The malware distribution leverages a vulnerable OPSWAT driver to bypass security controls. This technique allows the attackers to disable endpoint protection tools on compromised machines, significantly increasing the difficulty of detection and response. Key technical details from the campaign include: The payload is delivered via phishing lures tailored to Cambodian users. The exploit abuses a legitimate but vulnerable OPSWAT driver to gain kernel-level access. Once executed, Spark RAT provides attackers with remote control over the infected system. The malware is capable of evading security software by terminating or disabling its processes. Organizations in the region should review their security stack for exposure to the vulnerable OPSWAT driver and monitor for unusual system behavior. Users are advised to avoid opening unsolicited attachments or links, particularly those masquerading as government or public service communications. Source: The Hacker News Has your security team already audited your endpoints for the presence of this vulnerable driver, and what steps are you taking to detect Spark RAT activity in your environment?

Anthropic has issued a warning to a subset of Claude users that infostealer malware on their systems has been used to steal active login sessions for the AI assistant. Rather than compromising accounts through stolen passwords, these attackers are hijacking the existing session tokens, which allows them to authenticate as the legitimate user without triggering a standard login prompt. The result is that victims’ accounts are being accessed and drained by the attackers, consuming their allocated usage. This type of attack affects the convenience of persistent login sessions, as the stolen tokens bypass the usual re-authentication requirements. The warning highlights that the compromise originates from the user’s device being infected, rather than a breach on Anthropic’s side. For users concerned about exposure, the primary advice is to ensure that the endpoint is clean before taking further action. Recommended steps include: Run a full anti-malware scan on the affected device to identify and remove the infostealer. After the system is verified clean, log out of all active sessions on the Claude account to invalidate any stolen session tokens. Change the account password and enable two-factor authentication (2FA) if not already active. Likely indicators that a session has been compromised include unexpected usage spikes or changes to account settings that the user did not make. While the article does not identify the specific infostealer family or assign a CVE, the core lesson is that session tokens are a valuable target and that endpoint security is a critical component of protecting AI account usage. Source: Unknown Is your organization auditing for unusual usage spikes in AI assistant accounts as a potential early-warning sign of session hijacking?

Security researchers have uncovered a malicious campaign targeting users of Google Chrome and Microsoft Edge through extensions distributed on their official stores. The operation delivered a modular malware framework capable of exfiltrating cryptocurrency, sensitive user data, and browsing history, while also injecting ClickFix social engineering lures into web sessions. The extension set acted as a delivery mechanism for a multi-stage payload. Once installed, the framework deployed individual modules designed to perform specific malicious tasks, including credential harvesting and crypto wallet draining. The ClickFix injection technique presents users with fake error prompts that trick them into copying and running malicious commands, which can lead to further system compromise. Key details from the investigation include: Malicious extensions were available on both the Chrome Web Store and Microsoft Edge Add-ons store, bypassing initial security reviews. The framework's modules targeted browser history, cookies, and cryptocurrency wallet data. ClickFix lures were injected into legitimate web pages to trick users into executing PowerShell commands or other harmful scripts. The campaign appears to be ongoing, with new extensions potentially added over time. Users who installed any suspicious extensions should immediately remove them, revoke permissions granted to those extensions, and check for unauthorized transactions in their crypto wallets. Additionally, clearing browser cache and cookies, and resetting any credentials stored in the browser, is strongly recommended. Source: BleepingComputer Do you have visibility into your organization's approved browser extension list, and how do you enforce it against store-hosted threats?

AI has officially crossed the threshold from experimental to essential in security operations. The State of AI in Security Operations 2026 report, produced by Prophet Security in partnership with ViB, surveyed over 250 cybersecurity professionals and found that 40% of security teams now use AI on a daily basis. An additional 56% are actively testing it, leaving only 4% with no plans to adopt the technology at all. For the teams already leveraging AI, the operational impact is significant. Based on the report's findings, here are the ten most notable shifts: Alert Triage Acceleration: AI is dramatically reducing the time required to sort through false positives, allowing analysts to focus on genuine threats. Investigation Depth: AI tools are now capable of automatically pulling together contextual data from multiple sources, providing a holistic view of an incident without manual correlation. Response Automation: Routine containment actions, such as isolating endpoints or blocking malicious IPs, are increasingly being handled by automated AI workflows. Hunting Efficiency: Proactive threat hunting is becoming more data-driven, with AI surfacing anomalous behavior patterns that might otherwise be missed. Reduced Burnout: By handling repetitive tasks, AI is helping to alleviate the cognitive load on junior analysts, potentially improving retention rates. Skill Shift: The focus is moving away from manual log analysis toward prompt engineering and validating AI-generated outputs. Time-to-Response: The median time to respond to lower-severity incidents is shrinking significantly in organizations with mature AI deployments. Human Oversight Remains Key: The report emphasizes that while AI accelerates processes, human verification is still critical for complex or high-impact decisions. Tool Integration: Success is heavily dependent on how well AI solutions integrate with existing SIEM and SOAR platforms rather than operating as standalone silos. Data Quality Concerns: The primary barrier to effectiveness isn't the AI model itself, but the quality and cleanliness of the underlying telemetry data being fed into it. The data is clear: the debate over whether to use AI is over. The new conversation is about how to integrate it responsibly and effectively to augment human expertise. Source: The Hacker News Are your security teams part of the 40% using AI daily, and if so, how are you handling the shift toward data quality and human oversight?

Microsoft has uncovered a new twist on the ClickFix social engineering technique, which it tracks as TerminalFix. Unlike older campaigns that lure victims into the Windows Run dialog, this variant steers users toward Windows Terminal or PowerShell, making it more likely that a complex malicious command will be executed successfully. The attack chain relies on fake Cloudflare CAPTCHA pages that prompt users to verify they are human. Instead of a simple checkbox, the page instructs the user to copy a command and paste it into a terminal. Once pasted, the command establishes a reverse-tunnel backdoor on the system, giving the attacker remote access without requiring traditional malware files to be dropped on disk. The fake CAPTCHA page mimics Cloudflare branding to appear legitimate. The malicious command is obfuscated and designed to run in Windows Terminal or PowerShell. The backdoor uses a reverse tunnel to connect outbound, bypassing many firewall restrictions. Microsoft notes that this shift from the Run dialog to full-featured terminals increases the success rate of the attack, as users are more accustomed to pasting commands in these environments. The payload itself is delivered entirely in memory, leaving fewer forensic traces on the host. To mitigate this threat, users should avoid pasting commands from web pages into terminals unless they fully understand the command's purpose. Organizations should also monitor for unusual outbound connections and restrict PowerShell execution policies where possible. Source: The Hacker News Has your team tested user awareness against fake CAPTCHA prompts that instruct pasting into a terminal, and what was the click-through rate?

The Australian Federal Police (AFP) has charged two Western Australian men with a combined total of 14 offences for their alleged involvement in the cybercrime group known as TeamPCP. The group is accused of orchestrating the March 2026 supply chain compromise of open-source security scanners Trivy and Checkmarx KICS, as well as the AI gateway LiteLLM. Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21, appeared in the Perth Magistrates Court on August 27. The charges follow an extensive investigation into attacks that targeted widely used developer tools, raising significant concerns about software supply chain integrity. The AFP has not yet disclosed specific details regarding the method of initial access or the full extent of the data compromised during these incidents. Key facts from the court proceedings include: The two individuals face a combined total of 14 criminal charges. The alleged attacks occurred in March 2026. The affected projects include Trivy, Checkmarx KICS, and LiteLLM. The suspects appeared in court on August 27. The case underscores the growing threat landscape surrounding open-source dependencies, where a single compromised component can cascade across numerous downstream organizations. Further hearings will determine the admissibility of evidence and potential bail conditions. Source: The Hacker News Does your organization use any of the affected open-source tools in its CI/CD pipeline, and have you audited your recent builds for signs of tampering?

Security teams have spent years trying to shave seconds off their detection times, but AI is now shifting the battlefield to a more uncomfortable question: how much time do defenders actually have left to react? Modern AI models are being leveraged by attackers to automate vulnerability discovery, generate exploit code on the fly, and chain weaknesses together at a speed that traditional security operations simply weren't designed to match. The problem isn't just identifying another flaw anymore—it's that the window between an initial compromise and full lateral movement is collapsing. Attackers can now use AI to obfuscate payloads, mutate malware signatures, and adapt their tactics in real time based on the defenses they encounter. This fundamentally changes the economics of offense: what once took a skilled human analyst days can now be done in minutes. For defenders, this means the old "detect and respond" model is no longer sufficient. The focus needs to shift toward predictive readiness—building security operations that assume AI will be used against them and prepare automated responses accordingly. That involves integrating AI into your own defensive stack, not just as a faster SIEM, but as a proactive layer that can simulate attacker behavior, prioritize vulnerabilities by exploitability, and pre-stage threat hunting playbooks before an alert even fires. Building a security operations center ready for AI-powered attacks requires a few key shifts: Moving from reactive threat hunting to continuous AI-assisted red teaming that tests your environment against known AI-generated attack patterns Automating the triage process so human analysts are only pulled in for high-confidence, high-impact incidents rather than drowning in low-level alerts Ensuring your detection rules are updated against AI-generated variations of common exploits, not just static signatures Investing in behavioural analytics that can spot the subtle anomalies AI-driven intrusions often leave behind, rather than relying on known indicators of compromise Source: The Hacker News Has your team already integrated AI into your defensive workflows, or are you still relying on traditional detection methods to keep up with AI-driven attackers?

Researchers from Mindgard have detailed a prompt injection vulnerability in Amazon Kiro, an AI-powered, agentic integrated development environment (IDE). The issue could allow an attacker to exfiltrate sensitive data by leveraging the tool's "Kiro Powers" feature. The flaw, which currently has no CVE identifier assigned, affects Kiro IDE version 0.7.45 on Windows. It was disclosed without a patch being immediately available. Affected product: Amazon Kiro IDE 0.7.45 Platform: Windows Attack vector: Prompt injection via malicious content processed by Kiro Powers Impact: Potential exfiltration of sensitive project data or credentials The attack works by crafting a malicious prompt or injecting instructions into content that the IDE processes. When Kiro Powers acts on the injected instructions, it can be manipulated into sending data to an attacker-controlled endpoint. This is particularly concerning because agentic IDEs have access to source code, environment variables, and other development secrets. Given that Kiro is designed to operate with high-level autonomy, the research highlights a broader risk: the more permissions an AI assistant has, the more damage a successful prompt injection can cause. Organizations using agentic coding tools should review how they sandbox AI-driven actions and monitor for unusual outbound network requests. Source: The Hacker News Are you currently using Amazon Kiro or similar agentic IDEs in your development workflow, and how are you restricting their network access to mitigate this type of risk?

Researchers have identified a series of targeted campaigns aimed at government and diplomatic entities across Romania, Spain, and Türkiye, active from late September 2025 through early April 2026. The attacks, attributed by Recorded Future Insikt Group to threat actors with ties to APT28, result in the deployment of a previously unseen backdoor named HOOKEDGE. HOOKEDGE is a lightweight Windows batch script designed for stealth and minimal footprint. Rather than a complex implant, it relies on native system utilities to execute its objectives, making it harder for traditional endpoint defenses to flag as malicious. Key technical details from the analysis include: Delivery mechanism involves phishing or spear-phishing lures tailored to diplomatic and governmental affairs. Initial execution leverages a batch script that writes and runs additional payloads from temporary directories. Communication with command-and-control (C2) servers is conducted via standard HTTP requests, blending in with normal web traffic. The backdoor supports basic reconnaissance, file exfiltration, and the ability to download and execute secondary payloads. Persistence is achieved through scheduled tasks or registry modifications, though specifics vary per campaign iteration. The focus on high-value diplomatic targets aligns with APT28's historical interest in geopolitical intelligence gathering. Organizations in the public sector, particularly those involved in foreign affairs or defense, should treat these campaigns as a credible threat. Mitigation recommendations from the researchers include: Restrict execution of unsigned batch scripts in user and service accounts. Monitor for anomalous scheduled task creations, especially those referencing temporary directories. Enable detailed logging for PowerShell and Windows Script Host to catch secondary-stage activity. Conduct phishing awareness training tailored to diplomatic and administrative staff. Source: The Hacker News Are your organization’s endpoint defenses capable of detecting batch-script-based backdoors like HOOKEDGE, or would this slip past standard monitoring?

PaperCut has issued an urgent security advisory after confirming that threat actors are actively exploiting a vulnerability in its print management software. The flaw impacts all versions of both PaperCut NG and PaperCut MF, and the company has acknowledged verified customer incidents, stating it is treating the matter with the highest priority. The zero-day is being leveraged in live attacks, prompting the vendor to release an emergency patch targeting versions v25 and v26. Customers running any prior version are strongly advised to upgrade immediately to a patched release to mitigate exposure. Affected products: PaperCut NG (all versions prior to the emergency patch) PaperCut MF (all versions prior to the emergency patch) Mitigation steps: Apply the latest emergency patch provided by PaperCut for v25 and v26. If you are running an older version, upgrade to a supported, patched build without delay. Monitor your print server logs for suspicious activity or unauthorized access attempts. Restrict network access to PaperCut servers where possible. At this time, the vendor has not released detailed technical specifics about the vulnerability, but the active exploitation indicates a serious risk for organizations that rely on PaperCut for print management. Administrators should treat this as a priority and not delay patching. Source: The Hacker News Are any of you running PaperCut in your environment, and how quickly are you able to roll out the emergency patch?

Patches are now available for a critical vulnerability in cPanel and WebHost Manager (WHM) that could allow a single hosting customer to execute code as the root user. The flaw resides in the domain parking and addon domain functionality, potentially enabling a full server takeover. Tracked as CVE-2026-65643, this issue affects all supported versions of cPanel & WHM. The vendor has classified the severity as critical, urging administrators to apply the necessary updates immediately. Given that this requires no prior authentication beyond a standard hosting account, the risk of exploitation is significant for shared hosting environments. Key takeaways: Vulnerability in domain parking and addon domain functions leads to root-level code execution. Impacts all supported versions of cPanel & WHM. Patches are released; immediate updating is strongly advised. While specific technical details of the exploit chain are not yet public, the potential impact is severe. If you manage a server running cPanel, prioritizing this update is essential to prevent unauthorized root access. Administrators should verify their current version and ensure it is patched without delay. Source: The Hacker News Are you running a supported version of cPanel, and how quickly do you plan to roll out these patches to mitigate the risk of exploitation?

VulnCheck has identified two previously undocumented factory implants in firmware for routers manufactured by Shenzhen Zhibotong Electronics (ZBT). Each implant grants an unauthenticated remote attacker the ability to execute commands as root on affected devices, according to the firm's zero-day research team. The two implants, dubbed SPEAKINGSTONE and DARKLANTERN, are being tracked as CVE-2026-74232 and CVE-2026-74233, respectively. These are not post-exploitation backdoors added after the fact; they are present in the factory firmware itself, meaning devices ship with the vulnerabilities already in place. The implications are significant for any organization using ZBT hardware in their network infrastructure: Both implants allow remote code execution with root privileges, bypassing authentication entirely. Because the flaws are embedded in the firmware at the manufacturing stage, standard patching or reimaging may not remove them unless a vendor-supplied update specifically addresses the issue. Attackers exploiting these flaws would gain full control over the router, enabling traffic interception, persistent access, or use of the device as a pivot point into the broader network. At the time of writing, no vendor response or patching timeline has been mentioned in the report. Organizations using ZBT routers should treat them as untrusted and consider isolating them from sensitive network segments until a fix is confirmed. Source: The Hacker News Is your organization currently running any ZBT-based hardware, and if so, what steps are you taking to mitigate exposure while awaiting an official fix?